# CVE-2022-2588 — linux > As of 2025-05-22, CVE-2022-2588 is a MEDIUM-severity vulnerability in linux, CVSS v3.1 5.3, EPSS 5.8% (93.0th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2022-2588, most recently “NATS-as-C2: KeyHunter Distributed Worker Botnet Harvests Cloud Credentials and AI API Keys via Langflow RCE (CVE-2026-33017)”. **Last updated:** 2025-05-22 ## What is CVE-2022-2588? It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0. The record classifies CVE-2022-2588 under weakness class [CWE-416](https://intel.threadlinqs.com/cwe/CWE-416). Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 1024 days ago. ## Severity and exploitation probability - **CVSS v3.1 base score:** 5.3 — MEDIUM (`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H`) - **EPSS (FIRST):** 5.8% probability of exploitation in the next 30 days, higher than 93.0% of all scored CVEs - **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog - **Threadlinqs priority:** 8.4/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability - **Published:** 2024-01-08, last modified 2025-05-22 ## Is CVE-2022-2588 being exploited? Weaponised exploit code for CVE-2022-2588 is publicly available. 10 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 36 in the Threadlinqs vulnerability feed. - [Markakd/CVE-2022-2588](https://github.com/Markakd/CVE-2022-2588) (github) - [BassamGraini/CVE-2022-2588](https://github.com/BassamGraini/CVE-2022-2588) (github) - [veritas501/CVE-2022-2588](https://github.com/veritas501/CVE-2022-2588) (github) - [pirenga/2022-LPE-UAF](https://github.com/pirenga/2022-LPE-UAF) (github) - [konoha279/2022-LPE-UAF](https://github.com/konoha279/2022-LPE-UAF) (github) - [LSinus/CacheMeIfYouCan](https://github.com/LSinus/CacheMeIfYouCan) (github) - [ASkyeye/2022-LPE-UAF](https://github.com/ASkyeye/2022-LPE-UAF) (github) - [dom4570/CVE-2022-2588](https://github.com/dom4570/CVE-2022-2588) (github) ## Affected products and versions - **The Linux Kernel Organization**: linux ## How to fix CVE-2022-2588 No vendor patch reference has been recorded for CVE-2022-2588 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise. ## Threat activity tracking CVE-2022-2588 1 tracked threat in the Threadlinqs corpus references CVE-2022-2588, either in the campaign’s CVE list or as an indicator on the campaign record. - [NATS-as-C2: KeyHunter Distributed Worker Botnet Harvests Cloud Credentials and AI API Keys via Langflow RCE (CVE-2026-33017)](https://intel.threadlinqs.com/threat/TL-2026-0514) — HIGH · 2026-05-14 ## Sources Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10. **Third-party advisory** - [ubuntu.com — third party advisory](https://ubuntu.com/security/notices/USN-5565-1) - [ubuntu.com — third party advisory (USN 5562 1)](https://ubuntu.com/security/notices/USN-5562-1) - [ubuntu.com — third party advisory (USN 5582 1)](https://ubuntu.com/security/notices/USN-5582-1) - [ubuntu.com — third party advisory (USN 5564 1)](https://ubuntu.com/security/notices/USN-5564-1) - [ubuntu.com — third party advisory (USN 5566 1)](https://ubuntu.com/security/notices/USN-5566-1) **Issue tracking and product pages** - [openwall.com — issue tracking](https://www.openwall.com/lists/oss-security/2022/08/09/6) - [cve.mitre.org — issue tracking](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2588) - [zerodayinitiative.com — issue tracking](https://www.zerodayinitiative.com/advisories/ZDI-22-1117/) - [github.com — issue tracking](https://github.com/Markakd/CVE-2022-2588) - [lore.kernel.org — issue tracking](https://lore.kernel.org/netdev/20220809170518.164662-1-cascardo@canonical.com/T/#u) _Showing 10 of 15 recorded references._ Canonical: https://intel.threadlinqs.com/cve/CVE-2022-2588 Full detection coverage and IOCs for threats exploiting CVE-2022-2588 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp